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The Union des Marques, the french association of advertisers, thanks the EDPB to give 
industry the opportunity to comment the draft of guidelines on the targeting of social 
media users (08/2020) and on the concepts of controller and processor in the GDPR 
(07/2020). 


Regarding the concepts of controllers and processor in the GDPR, we are pleased that 
EDPB adopted guidelines to clarify the concepts of controller and processor and help 
industry to evaluate their status in the variety of situation that can occur. The section on 
join controllership, referring to recent case law is welcome particularly about the 
confirmation that the existence of joint responsibility does not necessarily imply equal 
responsibility of the various operators involved in the processing of personal data. 

In a general way, the fact that has been privileged a risk-based approach is also welcome. 
However, the principle of a case by case analysis should be more affirmed and some 
formulations and examples should be nuanced. For example the point 62 and the foot 
note 24 should be nuanced as it can suppose that the only fact to choice a standardized 
solution, to make the decision to use a technical solution package demonstrates the 


determination of the means of the processing entirely. 


Regarding targeting on social media users, we are pleased that EDPB gives clarifications 
on the status of join controllership and independent controllers. However, a case by case 
analysis should prevail. That is equally the same about the legal basis of the processings. 
The development on legitimate interest should be nuanced and a risk-based approach 
taking into account safeguards put in place and balance of interests should be taken into 
account. 

A sufficient period of time for companies to implement guidelines in their relationship 
should finally be provided by EDPB. 


